Brute-force attacks on /wp-login: how to limit attempts and hide your admin page

You open your hosting security report in the morning and see something alarming: hundreds, sometimes thousands of failed login attempts on /wp-login.php, from IP addresses all over the world. It's natural to wonder whether your site is already compromised. The good news: in most cases you aren't being targeted personally — these are automated bots mechanically trying passwords against any WordPress site they can find.

The even better news is that you're not helpless. With a few simple measures you can turn an exposed login page into one that's nearly impossible to crack by brute force. Let's walk through, step by step, what you actually do — from limiting attempts to hiding the admin page entirely.

Why you get hundreds of attempts (and when it's genuinely dangerous)

A brute-force attack means a program automatically tries username and password combinations until it hits a valid one. WordPress is the most-used platform in the world, and /wp-login.php is the standard address — so bots know exactly where to knock. Nobody singled you out; they simply scan the internet.

The real danger appears in a few situations:

• you have an account with a predictable name like "admin", "administrator" or your company name
• you use a short password or one reused from another site
• you have no mechanism to block IPs after too many failures

If any of those apply, the attack has real odds. If not, the logs are just annoying noise — but still worth cleaning up, because every attempt eats server resources and can slow your site down.

First layer: passwords and usernames bots can't guess

Before any plugin, fix the foundation. Most attacks succeed because of a weak password or an obvious username.

• Delete or rename the "admin" account. Create a new administrator with a unique name, reassign your posts to it, then delete the old one.
• Use a long, random password generated by a password manager. A multi-word passphrase is far harder to crack than a short password with symbols.
• Don't expose your author name in URLs. WordPress sometimes reveals the user via /?author=1 — check and block that.

This foundation costs nothing and removes the largest share of the risk. Even if bots keep knocking, there's nothing left to guess.

Limit login attempts

The second layer stops the attack mechanism itself: the number of tries. The idea is simple — after a few consecutive failures from the same IP, you block access for a period.

On WordPress there are dedicated "limit login attempts" plugins that do exactly this: you set, say, a small number of allowed tries, then a lockout that grows on repeat offenses. A bot that has to wait after every few attempts becomes practically useless.

If you have server access, you can go further with Fail2ban, which reads your logs and blocks IPs at the firewall level — more efficient, because it stops the traffic before it reaches WordPress. Combined with a plugin, you also cover the case where the attacker keeps rotating IPs.

Hide or protect the admin page

If bots can't find the login page, they can't attack it. You have several options, from simple to solid:

• Change the login URL. Plugins that rename /wp-login.php to an address only you know (for example /company-entry) instantly kill the wave of automated bots.
• Protect /wp-admin with a second password at the server level (HTTP Basic Auth, via .htpasswd or your hosting panel). The attacker hits a wall before ever seeing the WordPress form.
• Restrict access by IP if you always work from the same locations.

An honest caveat: hiding the address isn't absolute security — it's "security through obscurity." It hugely cuts automated noise, but it doesn't replace good passwords and attempt limiting. You use them together, as layers.

Add two-factor authentication and a firewall

Even if someone guesses the password, two-factor authentication (2FA) stops them: on top of the password, they need a code from your phone app. For an admin account, it's the best few-minute investment you'll make.

A web application firewall (WAF) — whether through a well-known security plugin or at the CDN level — filters bad traffic before it reaches your site. Many automatically block brute-force patterns, known bots and suspicious requests.

Together, these layers mean an attack that once filled your logs becomes, in practice, impossible: the address is hidden, abusive IPs are blocked, and even a correct password gets nowhere without the second step.

Too much hassle? We'll set it all up for you

Every measure above is real and you can do it yourself — but it takes time, attention and a little care not to lock yourself out. If you'd rather sleep easy without becoming a security admin, that's where MPO Web Studio comes in.

We work remotely, across the whole country, and set up a secure WordPress from scratch: a clean admin account, attempt limiting, hidden login, 2FA and a firewall — all tested, so you don't get locked out. We explain transparently what we did and why, with no jargon.

If you're staring at hundreds of attempts in your logs right now and want it to stop, send us a message on WhatsApp. We'll look at your situation together and tell you honestly what's worth doing.